*SECOFR vs. *SECADM when working with user profiles

I would like to know what is the difference of *SECADM ADN *SECOFR of user class (*USRCLS) when I add a user p...

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please login.

You have exceeded the maximum character limit.

Please provide a Corporate E-mail Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

rofile.

When creating or changing a user profile, the value specified for the User class parameter defaults the special authorities the profile is created with. The Special authority can be overridden to name specific special authorities, but it normally defaults to the settings associated with the user class.

The *SECOFR user class defaults to give the user all special authorities.
The *SECADM user class defaults to give the user *SECADM special authority.

The user class parameter is also used to default the menu options users see on IBM menus. Other than these two items, the user class is never used. Many people think it is used during the OS/400 security checking algorithm, but it is not.

Dig Deeper on iSeries system and application security

Provide authorization in order for a user to start a subsystem within startup routine Look in the audit journal (QAUDJRN) on the AS/400 for an authority failure message with the name of the library as the object name. Use the information provided by the DSPAUDJRNE command to solve the problem.

AS/400 system user class settings versus CL command authorities An AS/400 user class setting is not necessarily the setting that allows a user to run a command on the system. CL command authorities are separate settings that need to be understood.

Removing *ALLOBJ access and raising system security levels ISeries security expert Carol Woodbury explains how to smoothly transition to a higher system security level.

Check power user activity Security expert Rich Loeber regularly hears from shops where users, especially programmers, claim that they absolutely must have access to all objects to get through a normal work day. This is just not true, but some shops cave in and provide these authority levels as a form of appeasement.

Security implemented via default settings One Search400.com member writes, "I'm looking at security implemented via default settings." Do you see a risk of having any of the above commands not set to *EXCLUDE (e.g., *USE)?" Security expert Carol Woodbury says it depends. Click over and see why.

Setting the*CMD parameter I want to set the*CMD parameter in the CHGUSRAUD command for the users who have user class in *SECOFR.

CHGUSRAUD USRPRF (xxxxxxx) OBJAUD(*ALL) AUDLVL(*CMD)

How can I write the CL?

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

Meet all of our AS/400 experts

View all AS/400 questions and answers

More on this topic

Please create a username to comment.

Microsoft quantum development turns toward hardware

Top 5 options for Linux certifications

New hardware, use cases shape server benchmarking needs

More on this topic

Dig Deeper on iSeries system and application security

Related Q&A from Carol Woodbury

Have a question for an expert?

Start the conversation

0 comments

Register

Login

Forgot your password?

Your password has been sent to:

Please create a username to comment.